symfony/http-foundation · error · InvalidArgumentException

Invalid argument $savePath

Error message

Invalid argument $savePath '%s'.

What it means

NativeFileSessionHandler accepts an optional $savePath which may use PHP's N;-mode;depth;/path format with at most two semicolons (mode and depth). If the string contains more than two ';' separators, it is not a valid save path, and an InvalidArgumentException is thrown.

Solutions

1. Correct the $savePath to contain at most two semicolons, using the 'mode;depth;/path' format (e.g. '2;/tmp/sessions' or '0660;1;/var/lib/php/sessions').
2. Fix the session.save_path php.ini value if the path comes from ini_get().
3. Sanitize or validate user/env-supplied save paths before passing them to the handler.

Example fix

// before
$handler = new NativeFileSessionHandler('0666;2;/tmp/sessions;extra');

// after
$handler = new NativeFileSessionHandler('0666;2;/tmp/sessions');

$path = $savePath ?? ini_get('session.save_path');
if (substr_count($path, ';') > 2) {
    throw new \InvalidArgumentException("Invalid session save_path: $path");
}

try {
    $handler = new NativeFileSessionHandler($savePath);
} catch (\InvalidArgumentException $e) {
    // fall back to a known-good default save path
}

When it happens

Trigger: Passing a $savePath string with more than 2 semicolons to the constructor, or an ini_get('session.save_path') value malformed in the same way (e.g. '0666;2;/tmp/sess;extra').

Common situations: Misconfigured php.ini session.save_path; concatenating path segments containing ';' (e.g. PATH-style values or Windows drive letters used incorrectly); hand-built save path strings with typos.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• The following options are not supported
• You must provide the "database" and "collection" option for…
• The disposition must be either
• The filename fallback cannot contain the "%" character.
• The session handler " " does not support clearing all…

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/3351453f0f119a89. Report an issue: GitHub.

Appendix: source

Thrown at Session/Storage/Handler/NativeFileSessionHandler.php:40

    private const SESSION_FILE_PREFIX = 'sess_';

    /**
     * @param string|null $savePath Path of directory to save session files
     *                              Default null will leave setting as defined by PHP.
     *                              '/path', 'N;/path', or 'N;octal-mode;/path
     *
     * @see https://php.net/session.configuration#ini.session.save-path for further details.
     *
     * @throws \InvalidArgumentException On invalid $savePath
     * @throws \RuntimeException         When failing to create the save directory
     */
    public function __construct(?string $savePath = null)
    {
        $baseDir = $savePath ??= \ini_get('session.save_path');

        if ($count = substr_count($savePath, ';')) {
            if ($count > 2) {
                throw new \InvalidArgumentException(\sprintf('Invalid argument $savePath \'%s\'.', $savePath));
            }

            // characters after last ';' are the path
            $baseDir = ltrim(strrchr($savePath, ';'), ';');
        }

        if ($baseDir && !is_dir($baseDir) && !@mkdir($baseDir, 0o777, true) && !is_dir($baseDir)) {
            throw new \RuntimeException(\sprintf('Session Storage was not able to create directory "%s".', $baseDir));
        }

        if ($savePath !== \ini_get('session.save_path')) {
            ini_set('session.save_path', $savePath);
        }
        if ('files' !== \ini_get('session.save_handler')) {
            ini_set('session.save_handler', 'files');
        }
    }

View on GitHub (pinned to 5aea19cd67)